* Bugs with libbpf
@ 2020-01-15 6:35 Benjamin Nilsen
2020-02-11 20:01 ` Andrii Nakryiko
0 siblings, 1 reply; 2+ messages in thread
From: Benjamin Nilsen @ 2020-01-15 6:35 UTC (permalink / raw)
To: bpf
[-- Attachment #1: Type: text/plain, Size: 469 bytes --]
Hello,
I believe I found some bugs with libbpf and just wanted to share them here.
I have attached them below.
Regards,
Ben
The first one:
I believe there is an error with: libbpf_nla_dump_errormsg();
The second one:
libbpf_nla_parse();
Third one:
I believe there is a stack buffer overflow with the method
bpf_object__open_buffer() when running the attached program with the
input:
./LibbpfTest15.c (executable version) LibbpfTest15buginput LibbpfTest15buginput
[-- Attachment #2: LibbpfTest15.c --]
[-- Type: application/octet-stream, Size: 2121 bytes --]
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <memory.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <linux/bpf.h>
#include "bpf.h"
//#include "libbpf2.h"
#include <errno.h>
#include "nlattr.h"
#include <linux/rtnetlink.h>
#include <sys/socket.h>
#include "libbpf.h"
#include <sys/types.h> // for size_t
int main(int argc, char **argv){
typedef struct args{
int err;
char buf[100];
size_t size;
size_t offset;
int buffer[150];
int flags;
size_t obj_buf_sz;
char name;
char name1;
int rand1;
int rand2;
int rand3;
int rand4;
bool b1;
} args_t;
args_t pta;
/*
printf("Opening the file\n");
FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");
struct bpf_object;
struct bpf_object *bo;
bo = bpf_object__open(argv[1]);
printf("Opening bpf Object with argv[1]\n");
bpf_object__open(argv[1]);
//bpf_object__open(argv[1]);
*/
struct bpf_object;
struct bpf_object *bo;
printf("Opening the file\n");
FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp) != 1){
printf("File not big enough\n");
fclose(fp);
return 0;
}
FILE *fp2;
fp2 = fopen(argv[2], "rb");
printf("File name is: %s\n", argv[2]);
printf("Second File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp2) != 1){
printf("File not big enough\n");
fclose(fp2);
return 0;
}
printf("\nOpening bpf object via: bpf_object__open_buffer()\n");
char name5 = "a";
size_t obj_buf_sz = 5;
bo = bpf_object__open_buffer(argv[1], pta.obj_buf_sz, &pta.name);
printf("Opened a bpf file with bpf_object__open_buffer()\n\n");
if (bo == NULL){
printf("Returned: Invalid BPF_Prog\n");
return 0;
}
printf("Calling methods that use the bpf objects");
bpf_object__load(&bo);
bpf_object__kversion(&bo);
bpf_object__btf(&bo);
bpf_object__btf_fd(&bo);
bpf_object__unload(&bo);
//enum bpf_prog_type prog_type = BPF_PROG_TYPE_TRACEPOINT;
fclose(fp);
fclose(fp2);
printf("Test complete. Opened a bpf_program.\n");
return 0;
}
[-- Attachment #3: LibbpfTest5.c --]
[-- Type: application/octet-stream, Size: 1435 bytes --]
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <memory.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <linux/bpf.h>
#include "bpf.h"
#include "libbpf2.h"
#include <errno.h>
#include "nlattr.h"
#include <linux/rtnetlink.h>
int main(int argc, char **argv){
typedef struct args{
int one;
int two;
int maxtype;
int len;
bool b1;
bool b2;
bool b3;
bool b4;
int size;
struct nlattr nl;
struct nlattr head;
struct libbpf_nla_policy policy;
} args_t;
args_t pta;
printf("Driver program for nlattr.c class\n");
printf("Opening the file\n");
FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp) != 1){
printf("File not big enough\n");
fclose(fp);
return 0;
}
//printf("Calling libbpf_nla_dump_errormsg\n");
//libbpf_nla_dump_errormsg(&nlh);
//libbpf_nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head,
// int len, struct libbpf_nla_policy *policy);
int size = 5;
if(pta.size > 0 && pta. size < 999999){
size = pta.size;
}
struct nlattr tb[size];
for(int i = 0; i < size; i++){
tb[i] = pta.nl;
}
struct nlattr head;
struct libbpf_nla_policy policy;
printf("Calling libbpf_nla_parse\n");
libbpf_nla_parse(&tb, pta.maxtype, &pta.head,
pta.len, &pta.policy);
printf("Test complete.\n");
return 0;
}
[-- Attachment #4: libbpfTest4bug --]
[-- Type: application/octet-stream, Size: 1024 bytes --]
[-- Attachment #5: LibbpfTest15buginput --]
[-- Type: application/octet-stream, Size: 808 bytes --]
[-- Attachment #6: LibbpfTest4.c --]
[-- Type: application/octet-stream, Size: 1726 bytes --]
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <memory.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <linux/bpf.h>
#include "bpf.h"
#include "libbpf2.h"
#include <errno.h>
#include "nlattr.h"
#include <linux/rtnetlink.h>
int main(int argc, char **argv){
typedef struct args{
int one;
int two;
bool b1;
bool b2;
bool b3;
bool b4;
__u32 nlmsg_len; /* Length of message including header */
__u16 nlmsg_type; /* Type of message content */
__u16 nlmsg_flags; /* Additional flags */
__u32 nlmsg_seq; /* Sequence number */
__u32 nlmsg_pid; /* Sender port ID */
} args_t;
args_t pta;
printf("Driver program for nlattr.c class\n");
printf("Opening the file\n");
FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp) != 1){
printf("File not big enough\n");
fclose(fp);
return 0;
}
struct nlmsghdr {
__u32 nlmsg_len; /* Length of message including header */
__u16 nlmsg_type; /* Type of message content */
__u16 nlmsg_flags; /* Additional flags */
__u32 nlmsg_seq; /* Sequence number */
__u32 nlmsg_pid; /* Sender port ID */
};
struct nlmsghdr nlh;
nlh.nlmsg_len = pta.nlmsg_len; /* Length of message including header */
nlh.nlmsg_type = pta.nlmsg_type; /* Type of message content */
nlh.nlmsg_flags = pta.nlmsg_flags; /* Additional flags */
nlh.nlmsg_seq = pta.nlmsg_seq; /* Sequence number */
nlh.nlmsg_pid = pta.nlmsg_pid; /* Sender port ID */
printf("Calling libbpf_nla_dump_errormsg\n");
libbpf_nla_dump_errormsg(&nlh);
printf("Test complete.\n");
return 0;
}
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Bugs with libbpf
2020-01-15 6:35 Bugs with libbpf Benjamin Nilsen
@ 2020-02-11 20:01 ` Andrii Nakryiko
0 siblings, 0 replies; 2+ messages in thread
From: Andrii Nakryiko @ 2020-02-11 20:01 UTC (permalink / raw)
To: Benjamin Nilsen; +Cc: bpf
On Tue, Jan 14, 2020 at 10:35 PM Benjamin Nilsen <bcnilsen@ucdavis.edu> wrote:
>
> Hello,
>
> I believe I found some bugs with libbpf and just wanted to share them here.
> I have attached them below.
>
> Regards,
> Ben
>
>
> The first one:
> I believe there is an error with: libbpf_nla_dump_errormsg();
>
> The second one:
> libbpf_nla_parse();
Can you please expand on what the bugs are, specifically? It will help
direct libbpf developer's attention to fixing bugs, thanks.
>
> Third one:
> I believe there is a stack buffer overflow with the method
> bpf_object__open_buffer() when running the attached program with the
> input:
> ./LibbpfTest15.c (executable version) LibbpfTest15buginput LibbpfTest15buginput
Yyou code calls bpf_object__load() unconditionally, even if
bpf_object__open_buffer fails (which it obviously does in this case,
as you are giving it a random 5 bytes as an ELF file). Again, there
might be bugs, but please be more specific.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-02-11 20:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-15 6:35 Bugs with libbpf Benjamin Nilsen
2020-02-11 20:01 ` Andrii Nakryiko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).